further xss protection

chrisallenlane · Jun 23, 2016 · 1f8519e · 1f8519e
1 parent fcd6ce0
commit 1f8519e
Show file tree

Hide file tree

Showing 5 changed files with 7 additions and 6 deletions.
diff --git a/app/routes/archive.js b/app/routes/archive.js
@@ -31,8 +31,8 @@ module.exports = function (app, wit, callback) {
     res.render('archive', {
       page : {
         title      : 'archive',
-        name       : 'archive', // TODO: pretty date?
-        url        : req.url,
+        name       : 'archive',
+        url        : xss(req.url),
         content    : paginated.posts,
         pagination : paginated.pagination,
         date       : {

diff --git a/app/routes/category.js b/app/routes/category.js
@@ -24,7 +24,7 @@ module.exports = function(app, wit, callback) {
       page : {
         title      : 'category',
         name       : category,
-        url        : req.url,
+        url        : xss(req.url),
         content    : paginated.posts,
         pagination : paginated.pagination,
       },

diff --git a/app/routes/post.js b/app/routes/post.js
@@ -1,5 +1,6 @@
 const config   = require('../boot/config');
 const paginate = require('../util/paginate');
+const xss      = require('xss');
 var configs    = config();
 
 module.exports = function(app, wit, callback) {
@@ -16,7 +17,7 @@ module.exports = function(app, wit, callback) {
       page : {
         title      : 'blog',
         name       : 'blog',
-        url        : req.url,
+        url        : xss(req.url),
         content    : paginated.posts,
         pagination : paginated.pagination,
       },

diff --git a/app/routes/search.js b/app/routes/search.js
@@ -26,7 +26,7 @@ module.exports = function (app, wit, callback) {
       page : {
         title      : 'search',
         name       : query,
-        url        : req.url,
+        url        : xss(req.url),
         content    : paginated.posts,
         pagination : paginated.pagination,
       },

diff --git a/app/routes/tag.js b/app/routes/tag.js
@@ -21,7 +21,7 @@ module.exports = function(app, wit, callback) {
       page : {
         title      : 'tag',
         name       : tag,
-        url        : req.url,
+        url        : xss(req.url),
         content    : paginated.posts,
         pagination : paginated.pagination,
       },